CI: Switch tooling setup to Nix

.forgejo/workflows/setup-tools.sh

@@ -1,87 +0,0 @@
-#!/usr/bin/env sh
-
-set -eu
-
-TRIPLE="x86_64-unknown-linux-musl"
-TRIPLE_GNU="x86_64-unknown-linux-gnu"
-
-JUST_VERSION="1.51.0"
-JUST_SHA256SUM="c8f085ca3e885723c341d06243fc291b5abfdc8bbe3b2c076b117de490387b59"
-
-CARGO_LLVM_COV_VERSION="0.6.21"
-CARGO_LLVM_COV_SHA256SUM="57f491aedf7cdb261538ceb49cbb1ee9d27df7ca205a5e1a009caaf5cb911afb"
-
-CARGO_AUDIT_VERSION="0.22.1"
-CARGO_AUDIT_TAG="cargo-audit%2Fv$CARGO_AUDIT_VERSION"
-CARGO_AUDIT_SHA256SUM="1890badd5f15831a9af4b074399fcd21e6f7c0fe42c84e9254cdffc9f813765c"
-
-TAPLO_VERSION="0.10.0"
-TAPLO_SHA256SUM="8fe196b894ccf9072f98d4e1013a180306e17d244830b03986ee5e8eabeb6156"
-
-TYPOS_VERSION="1.47.2"
-TYPOS_SHA256SUM="7aef58932fc123b4cf4b40d86468e89a3297d80169051d7cfd13a235e05fc426"
-
-CARGO_DENY_VERSION="0.19.8"
-CARGO_DENY_SHA256SUM="70e769ae3872e34d45132b17040859175e11401dc12dddb0303e0b8c7d088f3f"
-
-CARGO_MSRV_VERSION="0.19.3"
-CARGO_MSRV_SHA256SUM="6f9a0011ca8ad959d304185b9090390fd1ad87e2d764007fbb0abe043afa9ff5"
-
-fetch() {
-    repo="$1"
-    tag="$2"
-    filename="$3"
-    digest="$4"
-    binary="$5"
-    renamed_binary="${6:-$binary}"
-
-    [ -d /tmp/tools ] || mkdir -p /tmp/tools
-
-    curl -fsSLO --output-dir /tmp \
-        -w '%{stderr}HTTP %{response_code} %{url}\n' \
-        "https://github.com/$repo/releases/download/$tag/$filename"
-
-    printf '%s  %s\n' "$digest" "/tmp/$filename" > /tmp/digest
-    sha256sum --check /tmp/digest
-
-    if printf '%s' "$filename" | grep -qE '\.tar\.|\.tgz$'; then
-        tar xf "/tmp/$filename" -C /tmp/tools
-    elif printf '%s' "$filename" | grep -q '\.gz$'; then
-        gunzip -c "/tmp/$filename" > "/tmp/tools/$binary"
-    else
-        echo "Fatal: can't determine how to unpack $filename"
-        exit 1
-    fi
-
-    find /tmp/tools -type f -name "$binary" \
-        -exec mv -v '{}' "/usr/local/bin/$renamed_binary" ';'
-    chmod +x "/usr/local/bin/$renamed_binary"
-}
-
-fetch casey/just "$JUST_VERSION" \
-    "just-$JUST_VERSION-$TRIPLE.tar.gz" \
-    "$JUST_SHA256SUM" just
-
-fetch taiki-e/cargo-llvm-cov "v$CARGO_LLVM_COV_VERSION" \
-    "cargo-llvm-cov-$TRIPLE_GNU.tar.gz" \
-    "$CARGO_LLVM_COV_SHA256SUM" cargo-llvm-cov
-
-fetch rustsec/rustsec "$CARGO_AUDIT_TAG" \
-    "cargo-audit-$TRIPLE_GNU-v$CARGO_AUDIT_VERSION.tgz" \
-    "$CARGO_AUDIT_SHA256SUM" cargo-audit
-
-fetch tamasfe/taplo "$TAPLO_VERSION" \
-    "taplo-linux-x86_64.gz" \
-    "$TAPLO_SHA256SUM" taplo-linux-x86_64 taplo
-
-fetch crate-ci/typos "v$TYPOS_VERSION" \
-    "typos-v$TYPOS_VERSION-$TRIPLE.tar.gz" \
-    "$TYPOS_SHA256SUM" typos
-
-fetch EmbarkStudios/cargo-deny "$CARGO_DENY_VERSION" \
-    "cargo-deny-$CARGO_DENY_VERSION-$TRIPLE.tar.gz" \
-    "$CARGO_DENY_SHA256SUM" cargo-deny
-
-fetch foresterre/cargo-msrv "v$CARGO_MSRV_VERSION" \
-    "cargo-msrv-$TRIPLE_GNU-v$CARGO_MSRV_VERSION.tgz" \
-    "$CARGO_MSRV_SHA256SUM" cargo-msrv

.forgejo/workflows/verify.yaml

@@ -17,9 +17,14 @@ jobs:
     timeout-minutes: 20
     container:
       image: rust:slim
+      env:
+        RUSTUP_HOME: /rust/rustup
+        CARGO_HOME: /rust/cargo
     steps:
       - name: Install action dependencies
-        run: apt-get install --no-install-recommends --update -y nodejs curl git
+        run: >
+          apt-get install --no-install-recommends --update -y
+          nodejs git curl xz-utils
 
       - name: Checkout code
         uses: actions/checkout@v6
@@ -28,35 +33,41 @@ jobs:
 
       - name: Set up Rust toolchain
         run: |
+          mkdir -p "$RUSTUP_HOME"
+          mkdir -p "$CARGO_HOME"
+
+          rust_version=$(
+              grep '^rust-version = "' Cargo.toml \
+              | cut -d '"' -f 2
+          )
+
+          rustup default "$rust_version"
+          rustup toolchain install nightly
           rustup component add llvm-tools
           rustup component add --toolchain nightly rustfmt clippy
-          rustup target add x86_64-unknown-linux-gnu
-          rustup target add x86_64-unknown-linux-musl
-
-      - name: Set up additional tooling
-        run: .forgejo/workflows/setup-tools.sh
+          rustup target add x86_64-unknown-linux-musl x86_64-unknown-linux-gnu
 
       - name: Set up CI user
         run: |
-          useradd -m ci && chown -R ci:ci .
-          git config --global --add safe.directory "$PWD"
+          useradd -m ci
+          mkdir /nix
+          chown -R ci:ci "$RUSTUP_HOME" "$CARGO_HOME" "$PWD" /nix
+          printf '[safe]\ndirectory = %s\n' "$PWD" > /etc/gitconfig
 
-      - name: Text matches
-        run: just ci todos-assess version-assess spell
-      - name: Schema lint
-        run: just ci schema-lint
-      - name: Deny
-        run: just ci deny
-      - name: Format
-        run: just ci format-assess
-      - name: Lint
-        run: just ci lint-assess
-      - name: MSRV
-        run: just ci msrv-assess
-      - name: Cargo check
-        run: just ci check
-      - name: Test
-        run: just ci test
-      - name: Coverage
-        run: just ci cover-assess
+      - name: Set up Nix
+        run: |
+          mkdir /etc/nix
+          echo experimental-features = nix-command flakes \
+            >> /etc/nix/nix.conf
+          su ci -c "
+            sh -c 'curl -L https://nixos.org/nix/install |
+              bash -s -- --no-daemon' \
+          "
 
+      - name: Assess
+        run: |
+          su ci -lc "
+            export RUSTUP_HOME=$RUSTUP_HOME CARGO_HOME=$CARGO_HOME
+            nix develop path:$FORGEJO_WORKSPACE -c \
+              just -f $FORGEJO_WORKSPACE/.justfile verify
+          "